Buggy code:
} public EnumSet < GlobalPlatform . APDUMode > defaultMode = EnumSet . of ( GlobalPlatform . APDUMode . MAC ) ; private static final byte CLA_GP = ( ( byte ) ( 128 ) ) ; private static final byte CLA_MAC = ( ( byte ) ( 132 ) ) ; private static final byte INS_INITIALIZE_UPDATE = ( ( byte ) ( 80 ) ) ; private static final byte INS_INSTALL = ( ( byte ) ( 230 ) ) ; private static final byte INS_LOAD = ( ( byte ) ( 232 ) ) ; private static final byte INS_DELETE = ( ( byte ) ( 228 ) ) ; private static final byte INS_GET_STATUS = ( ( byte ) ( 242 ) ) ; private static final byte INS_PUT_KEY = ( ( byte ) ( 216 ) ) ; public AID sdAID = null ; private int scpMajorVersion = 0 ; private static final byte [ ] iv_null_bytes = new byte [ ] { 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 } ; private static final IvParameterSpec iv_null = new IvParameterSpec ( GlobalPlatform . iv_null_bytes ) ; public static final int defaultLoadSize = 255 ; private GlobalPlatform . SecureChannelWrapper wrapper = null ; private KeySet staticKeys = null ; private CardChannel channel = null ; private byte [ ] cplc = null ; private AIDRegistry registry = null ; private boolean dirty = true ; private PrintStream verboseTo = null ; protected boolean strict = true ; public GlobalPlatform ( CardChannel channel ) { } protected boolean beVerbose ( ) { } public void beVerboseTo ( PrintStream out ) { } protected void verbose ( String s ) { } public void setStrict ( boolean strict ) { } public void imFeelingLucky ( ) throws CardException , GPException { } protected void printStrictWarning ( String message ) throws GPException { } private int getGPCLA ( ) { } public boolean select ( AID sdAID ) throws CardException , GPException { } public void select ( ) throws IOException , CardException , GPException { } public List < KeySet . Key > getKeyInfoTemplate ( ) throws CardException , GPException { } public byte [ ] fetchCardData ( ) throws CardException , GPException { } public void discoverCardProperties ( ) throws CardException , GPException { } public byte [ ] fetchCPLC ( ) throws CardException , GPException { } public byte [ ] getCPLC ( ) throws CardException , GPException { } public void openSecureChannel ( KeySet staticKeys , int scpVersion , EnumSet < GlobalPlatform . APDUMode > securityLevel ) throws CardException , GPException { } private KeySet deriveSessionKeysSCP01 ( KeySet staticKeys , byte [ ] hostRandom , byte [ ] cardResponse ) { } private KeySet deriveSessionKeysSCP02 ( KeySet staticKeys , byte [ ] sequence , boolean implicitChannel ) throws CardException { } public ResponseAPDU transmit ( CommandAPDU command ) throws CardException , GPException { } private ResponseAPDU always_transmit ( CommandAPDU command ) throws CardException , GPException { } public AIDRegistry getRegistry ( ) throws CardException , GPException { } public void loadCapFile ( CapFile cap ) throws CardException , GPException { } private void loadCapFile ( CapFile cap , boolean includeDebug , boolean separateComponents , boolean loadParam , boolean useHash ) throws CardException , GPException { } public void installAndMakeSelectable ( AID packageAID , AID appletAID , AID instanceAID , byte privileges , byte [ ] installParams , byte [ ] installToken ) throws CardException , GPException { } public void makeDefaultSelected ( AID aid , byte privileges ) throws CardException , GPException { } public void uninstallDefaultSelected ( boolean deps ) throws CardException , GPException { } public void deleteAID ( AID aid , boolean deleteDeps ) throws CardException , GPException { } private byte [ ] encodeKey ( KeySet . Key key , Key kek , boolean withCheck ) { try { ByteArrayOutputStream baos = new ByteArrayOutputStream ( ) ; baos . write ( 128 ) ; baos . write ( 16 ) ; Cipher cipher ; cipher = Cipher . getInstance ( "DESede//ECB//NoPadding" ) ; cipher . init ( Cipher . ENCRYPT_MODE , kek ) ; baos . write ( cipher . doFinal ( key . getValue ( ) , 0 , 16 ) ) ; if ( withCheck ) { baos . write ( 3 ) ; <START_BUG> SecretKeySpec ky = new SecretKeySpec ( Arrays . copyOfRange ( key . getValue ( ) , 0 , 16 ) , "DESede" ) ; <END_BUG> cipher . init ( Cipher . ENCRYPT_MODE , ky ) ; byte [ ] check = cipher . doFinal ( GlobalPlatform . iv_null_bytes ) ; baos . write ( check , 0 , 3 ) ; } else { baos . write ( 0 ) ; } return baos . toByteArray ( ) ; } catch ( IOException e ) { throw new RuntimeException ( e ) ; } catch ( InvalidKeyException e ) { throw new RuntimeException ( e ) ; } catch ( IllegalBlockSizeException e ) { throw new RuntimeException ( e ) ; } catch ( BadPaddingException e ) { throw new RuntimeException ( e ) ; } catch ( NoSuchAlgorithmException e ) { throw new RuntimeException ( e ) ; } catch ( NoSuchPaddingException e ) { throw new RuntimeException ( e ) ; } } public void putKeys ( List < KeySet . Key > keys , boolean replace ) throws CardException , GPException { } private byte [ ] getConcatenatedStatus ( int p1 , byte [ ] data ) throws CardException , GPException { } private AIDRegistry getStatus ( ) throws CardException , GPException { } private static void check ( ResponseAPDU r , String msg ) throws GPException { } public static class SecureChannelWrapper { private KeySet sessionKeys = null ; private byte [ ] icv = null ; private byte [ ] ricv = null ; private int scp = 0 ;

Fix:
SecretKeySpec ky = new SecretKeySpec ( KeySet . getKey ( key . getValue ( ) , 24 ) , "DESede" ) ;